<?php
require_once __DIR__ . '/config.php';

/**
 * Start a session exactly once per request, with safe defaults.
 * Safe to call anywhere; no-op if the session is already active.
 */
function session_start_once(): void {
    if (session_status() === PHP_SESSION_ACTIVE) return;

    session_name(AUTH_SESSION_NAME);

    // Only set cookie params if we haven't sent the session cookie yet
    session_set_cookie_params([
        'lifetime' => AUTH_SESSION_LIFE,
        'path'     => '/',
        'secure'   => !empty($_SERVER['HTTPS']),
        'httponly' => true,
        'samesite' => 'Lax',
    ]);

    session_start();
}